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TM TpHF. r.T AIMS 

l«^ge source code using a virus scan engine, the method compr^smg: 
receiving aportion of iirierpretedlanguagesoijrc^ 

receiving a p ,^n-«entetion of Ihe portion of the interpreted 

generating a language-indepetxdent lepreseniafton oi,uw f 

language source code; sienature in a pattern 

comparingthelanguage-indepeod^ntrepreseatatumv^thavmissign^ 

^ . ^presentation matches the virus signature, 

determining if the language-mdependent representation mai 

whereby a matcb indicates a computer virus has been identified. 



2. (Original) Themethodofclaiml.^reintheinterpretedlanguagesource 
code is a sOT.pting language source code. 



3 (Original) Tbem^odofclaiml,whereinthevirussignatureisalanguase. 
ipdependent representation of an interpreted language source code computer virus. 



4 (Original) The methodof claim 1, ^^erein the portion of interpreted language 

source code and^evi^sipiamrearere^resentedasalinearized^gofkey actions. 
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5. (Cu.«ntlyam«^ed) A method for genexating a vixussigua^ using a virus 

scan engine, the mefliod comprising: .„^„nter virus- 

receiving a portion of interpreted language so^e code contanmxg a coxnpuier vmxs, 

iLattag a l^nguige-indepcndent representation of the computer vuus fes^^a^dBO^ 
^a^j^usingaaiatWltbreadizox^. In mMI .rHTi^<T^n..nr..pr..e.ta ,.op.s, 

liTifiarized str ^p nfWfev actions: and 

storing the language-independent lepreseotation of tbeco^^,uter virus asavm^ 

signatuxe. 

gcaeraliBg the language^independent representation of the computer virus using 

6. (Origmal) The method of claim 5, vAcrein the interpreted kmguage source 

code is a scripting language source code. 



7, (Original) 
biliary fonnat. 



The 



method of claim 5, wherein the vims signature is compiled in 



(cancelled) 



9. (Original) 
&om a virus analyst. 



The method of claim 5, wherein the virus signature includes input 



10. (cancelled) 
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U Cpreviou.lyprese.ted> A n^e^od for identifying a virus i. Wed lan^e ^ 

sourcecodeusingavir«sscanengine.themethodcomprisiBg: ; 
receiving apottion of iirtetpreted language source code; 

pir^e pordo. of the interpreted lar^guage source code .to tokens to genera^ ; 

tol.ni^dso^ceJdeusingaparser,w.ereinatleastson.eoftheto.ensrcp^^^^^ ^ 

^cwcdng selected key actions &om the tokenized source code, g 
liijearizingtbekeyactionstogenerateanexecuiingthxead; ^ 
cornparingtl^e^cecutingthread^thavirussigDatureofaknowrrvir^ ^ 

xnatcher; and 



determinmg 



vdiether the executing thread matches the virus signature. ^ 

12. (Original) Tl« method ofclaim 11, further comprising: 

ouiputting the identification of the ktxowa virus. g 

! 

13. (Original) Themelhodof claim 11, vixerein the portion of Ihc interpreted 
Umguage source code is lexically parsed. 



14. (Original) The method of claim 1 1, wherein Ihe portion of the interpreted 

language source code is lexically and grammatically parsed. 
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AmethodusingavirusscaxxexigmeforgeneTatmgavmis 
15. (previously presented) _ j^^udixig a comp^itef vi^^ 

^gnature ftom a portion of interpreted leu^guage source code mdud^ig 

method comprising: .^h^ r^ritaimne a computer virus; 

t^^vfaieaportioixofinteipretedlangoagesourcecodecoirtainmg^ 

i^, totoized sourc. «d. usu.g a parser, 

represent key actions; 

extracting key actions from the tokenized source code, 

li,,eariringthekeyactionstogenerateanexecudngtbreM 

detennining the setofnnmmumkey actions ialheexec^tingthreadr^^^ 

computer virus; and 

storing the set of minimum key actions as a virus signature. 

16. (OrigJnal) Hxemethodof claim 15. further comptising: 

compiling the virus signature in binary format 

17 (Original) The method of claim 15, further comprising: 

compUing the virus signature with data input by a virus analyst; and 
storing the virus signature as part of a virus pattern fUe. 

18. (Original) Tiie method of claim 17, wherein the virus patten file further 

includes a dictionary of key actions. 



19. (Original) -n^ method ofclaim 15. whereinthe portion of the interpreted 

language source code is lexically parsed. 



20, (Original) The method of claim 15, wherein the portion of the interpreted 

language source code is lexically and grammatically parsed. 
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n. (previouslyprese^) A co^p.te. readable .ediuxn P-^-^^^^^^ 

compvrter readable medium comprising instructions for: 

recwving a portion of jflt&ipteted language source code; 

I««ing the portion of tbe intetptet«d language source code u^o tokens to generate a 
tolcenizedsoureecodeusing.paxser, wherein atleastson^e of the tokens repres^^ 

linearizing at least a portion of the key actions to generate an executing thread; 
comparing the executing thread with a virus signature of a known computer vnrus m a 

patteoi matcher; and 

determining whether thp executing thread matches the virus signature. 

72. (Original) The computer readable medium of claim 21, furtb^ comprising: 

outputting the identification of the known computer virus. 



23. (Original) Thecomputer readable medium of claim 21, wherein the portion of 

the inteipieted language source code is lexically parsed. 



24. (Original) Tbs computer readable medium of claim 21, wheremthe portion of 

the interpreted language soince code is lexioaUy and grammatically parsed. 
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25. (previously preseated) Acomp portion of interpreted language 

parsing the portion of the interpreted language suw 

lepresentkey actions; .,.t^ «n evecirdne thread using a 

linearizing at least a portion of the Icey actions to generate an execotmg threaa 

"^^in^gthesetofnih^^ g 

conqnxter vims; and ^ 

Storing the set of minimum key actions as a virus signature. jy 

IDQ 

26. (OrigW) Ttec«nvawr«dablemedi«notcldm25.fi«tercon«^: ^ 
conmiling the virus signature in binary format < 

■ • CO 

27. (Original) The computer readable medium of claim 25, fbrUierconq^ismg. 
compiling the virus signature ^vitil data input by a virus analyst; and 

Storing the virus signature as part of a virus pattern file. 



28. (Original) Thecomputer readable medium of claim 27, vrherein the virus 
pattern file further includes a dictionary of key actions. 

29. (Original) m computer readable medium of claim 25, ^vherein the pordon of 
the interpreted language source code is lexically parsed. 

30 (Original) Tie compnier readable medium of claim 25, wherein the portion of 

the interpreted language source code is lexically and grammatically parsed. 
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